Post

SharePoint shows a nice error that something went wrong and provides the end user with a correlation ID. Users will then create a ticket or call you asking to verify what went wrong and you may ask for the correlation ID. If the users provides all the information you already have the timestamp but not the server where the issue occurred as you may have multiple servers in your farm. There are already two PowerShell cmdlets which we can use to search in log files. We can use Get-SPLogEvent when we know on which server the error occurred on to retrieve the different messages. We can also use Merge-SPLogFile which will search the ULS on all servers for a specific time period or also based on the correlation ID.

The below function is a variation of the Merge-SPLogFile script where it will look for the specific correlation ID in each ULS log file it finds in your SharePoint server farm. The below function just needs the log directory (which needs to be on the same location for all servers) and the correlation ID. It will then try to read all the ULS log files for all servers and find the correlation ID you specified. If this doesn’t provide you with more information you at least have the server on which the issue occurred and can open the ULS log file to investigate further.

Function Get-CorrelationLinesFromULS ($LogDirectory, $CorrelationID){
    if ( (Get-PSSnapin -Name microsoft.sharepoint.powershell -EA "SilentlyContinue") -eq $null )
    {
        Add-PsSnapin microsoft.sharepoint.powershell
    }
    
    $SPServers = get-spserver | ? { $_.Role -ne "Invalid"}
    $UNCPath = "$(($LogDirectory).Replace(':','$'))"
    $lines = @()
    $lines += "Timestamp              	Process                                 	TID   	Area                          	Category                      	EventID	Level     	Message 	Correlation"

    foreach ($SPServer in $SPServers)
    {
        try{
            $ServerUNCPath = "\\$($SPServer.name)\$($UNCPath)"
            write-host -f Cyan "Reading the log directory $($ServerUNCPath) on $($SPServer.name)..."

            foreach($file in (Get-ChildItem $ServerUNCPath | Sort-Object LastWriteTime -Descending | Where-Object{$_.name -like "$($SPServer.name)*"})){
                
                write-host -f Gray "Reading file $($file) and looking for $($CorrelationID)..."
                Get-Content "$($ServerUNCPath)\$($file)" | Where-Object {$_ -match $CorrelationID} | ForEach-Object {
                    write-host $_
                    $lines += $_
                }
            }
        }
        catch{
            write-host -f red "Error occurred clearing the configuration cache on $($SPServer.name);$($_.Exception.Message)..."
        }
    }

    return $lines
}

First start PowerShell as administrator on a server in the farm.

Then copy and paste the above code to the PowerShell Window to load the function

Then use the following command to start the search

$output = get-CorrelationLinesFromULS -LogDirectory "D:\SharePoint\Logs\Diagnostic" -CorrelationID "165fc49e-08e2-f084-a3e2-3f0b1bee4369"

You will have a variable $output which contains the found lines. This can be outputted in the PowerShell window directly or use | out-file “Location”\”filename”.log. This log file can be opened again with the ULS viewer to have a better view of the file.